I'm under the impression that stegonographic manipulation of file names or packet timing would qualify as a storage covert channel and a timing covert channel respectively.

I came across this seemingly contradictory quote (without citation) on the Covert Channel Wikipedia page:

Covert channels are distinct from, and often confused with, legitimate channel exploitations that attack low-assurance pseudo-secure systems using schemes such as steganography or even less sophisticated schemes to disguise prohibited objects inside of legitimate information objects.

However, CWE's Covert Channel definition specifically gives stegenography as an example of a storage covert channel technique.

Steganography, concealing information in such a manner that no one but the intended recipient knows of the existence of the message, is a good example of a covert storage channel.

Is one definition incorrect or is this an arguable matter of definition? Does steganography apply to both, one, or neither of these types of covert channels?

(For context, I am studying for the CISSP and looking for additional contexts/examples as my study materials do not go into this level of detail.)

1 Answer 1


As far as I know a covert channel is a communication path that is not expected in a working secure system.

For example an operating system uses a driver as a communication path between the user mode and the hardware (kernel mode) if there is any other way to reach the same destination bypassing the driver security controls then you found a covert channel.

It is related in how the application is supposed to work and you subvert it.

stenography it is a covert channel to communicate with others but it is not a failure in the application, you are not bypassing any security controls on the application you are just simply doing what is expected to do and use an application to hide a message in a picture. No security control is being bypassed the application you use is expected to do that and was built for it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .